Is PHP really the software behind most websites?

The short answer

Roughly, if you count websites, not servers or the internet. Cloudflare and OpenAI say PHP is used by almost 70% of websites; Wiz's '70% of the Internet' is the same figure restated and is not supported by anything the site has captured. Counts of internet-facing PHP hosts are in the low millions (2.6 million, of which Censys counted 1.57 million unpatched on 21 October).

To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/most-websites/index.html

The answer, with its sources

About 70% of websites is the figure Cloudflare and OpenAI use. It is a share of websites whose server-side language could be identified, so it is reported, not confirmed. Cloudflare OpenAI on X Wiz

'70% of the Internet' is the same number in a Wiz headline and post. The body of Wiz's own post says websites. This site marks the Internet version unverified. Wiz Wiz on X

Hosts, not websites: VulnCheck counts about 2.6 million internet-facing hosts running PHP; Censys counted 1.57 million of the 2.58 million it saw with a readable version still unpatched on 21 October. One host can serve thousands of sites. THN SecurityWeek

Being built on PHP is not the same as being exploitable. The CVE vector says attack complexity is high, and Fastly says the public exploits need knowledge of the exact PHP build on a 64-bit server. CVE record Fastly Imperva Threat Research

The pages that carry it

• The numbers: 70%, 30 million, 2.6 million, 6,000, 674
• Every claim, with its status and sources
• Affected systems: versions, deployments, applications, inventory